PT-2023-5268 · Apache · Apache Inlong

4Ra1N + 1 · Publicado 2023-07-25 · Atualizado 2024-10-02 · CVE-2023-34434

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.4.0 through 1.7.0

Description The issue affects Apache InLong, allowing an attacker to bypass the current logic and achieve arbitrary file reading by exploiting a deserialization of untrusted data vulnerability. This could enable a remote attacker to read files arbitrarily.

Recommendations To solve this issue, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8130.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

BDU:2023-05885

CVE-2023-34434

GHSA-PQ67-9JF9-HC3C

Produtos afetados

Apache Inlong

Referências · 14

• https://github.com/apache/inlong · Nota
• https://github.com/apache/inlong/pull/8130 · Nota
• https://github.com/apache/inlong/commit/34835f827771074345f42a9b1658d018f202516e · Nota
• http://seclists.org/fulldisclosure/2023/Jul/43 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-34434 · Nota de Segurança
• https://t.me/cibsecurity/67213 · Publicação no Telegram
• https://t.me/cvenotify/55172 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-05885 · Nota de Segurança
• https://lists.apache.org/thread/7f1o71w5r732cspltmtdydn01gllf4jo · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-34434 · Aviso do Fabricante
• https://t.me/cvenotify/96858 · Publicação no Telegram
• https://t.me/cvenotify/55063 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-pq67-9jf9-hc3c · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/07/25/3 · Nota